Privacy Policy

VirtueCore (“we,” “our,” or “us”) operates the VirtueCore VA Marketplace platform (“Platform”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. Please read it carefully. If you disagree with its terms, please stop using the Platform.

1. Information We Collect

We collect information you provide directly to us:

• Account information: name, email address, role (VA or client), password (hashed — never stored in plain text)
• Profile information: headline, bio, skills, hourly rate, location, timezone, availability, profile photo
• Job and application data: job postings, cover letters, proposed rates, application status
• Messages: content of direct messages between users on the Platform
• Payment information: billing details processed by Stripe — we never store card numbers directly
• Academy progress: course completion records, lesson progress, earned badges
• Reviews: ratings and written reviews you submit about other users

We also collect information automatically:

• Browser type, IP address, device type, operating system
• Pages visited, time spent, referring URLs
• Session cookies managed by Supabase Auth

2. How We Use Your Information

• Create and maintain your account
• Display your public VA profile on the Marketplace
• Facilitate job postings, applications, and hiring
• Enable direct messaging between clients and VAs
• Process payments and subscriptions through Stripe
• Send transactional emails (application updates, new messages) via Resend
• Track and display your Academy course progress and earned badges
• Improve Platform features and user experience
• Detect and prevent fraud, abuse, or violations of our Terms
• Comply with applicable law

3. How We Share Your Information

We do not sell your personal data. We share information only in these circumstances:

• Other Platform users: Your public VA profile (name, headline, skills, rate, badges, reviews) is visible to all logged-in users. Your messages are visible only to the conversation participants.
• Service providers: Supabase (database and auth), Stripe (payments), Resend (transactional email), Vercel (hosting). Each is bound by data processing agreements.
• Legal compliance: If required by law, court order, or governmental authority.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.

4. Data Storage and Security

Your data is stored in Supabase’s managed Postgres database hosted on AWS infrastructure. We use Row Level Security (RLS) policies to ensure users can only access data they are authorized to see. All data in transit is encrypted via TLS. Passwords are hashed using bcrypt via Supabase Auth.

Despite these measures, no system is 100% secure. We encourage you to use a strong, unique password and to notify us immediately at privacy@virtuecore.com if you suspect any unauthorized access to your account.

5. Cookies and Tracking

We use session cookies set by Supabase Auth to keep you logged in. These are essential for the Platform to function and cannot be disabled without logging out. We do not use third-party advertising cookies or cross-site tracking pixels.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — update inaccurate or incomplete data (available directly in Account Settings)
• Deletion — request deletion of your account and associated data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing where we rely on legitimate interests

To exercise any of these rights, email privacy@virtuecore.com. We will respond within 30 days.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal purposes (e.g., billing records for 7 years per tax law). Messages and reviews may be retained in anonymized form for platform integrity.

8. Children's Privacy

The Platform is not directed to anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected information from a minor, contact us immediately and we will delete it.

9. International Transfers

VirtueCore serves users globally. Your data may be transferred to and processed in the United States and other countries where our service providers operate. By using the Platform, you consent to this transfer. We ensure appropriate safeguards are in place in accordance with applicable data protection law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and, where appropriate, sending an email to the address on your account. Your continued use of the Platform after any change constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions or requests, contact:
VirtueCore Privacy Team
privacy@virtuecore.com